http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c2 Mindaugas Baranauskas changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(opensuse.lietuviu | |.kalba@gmail.com) | --- Comment #2 from Mindaugas Baranauskas --- OK, see attachment as https://bugzilla.opensuse.org/attachment.cgi?id=680561 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c3 --- Comment #3 from Christian Boltz --- You need to add the attach_disconnected flag. Edit /etc/apparmor.d/usr.sbin.nscd and replace /usr/sbin/nscd { with /usr/sbin/nscd flags=(attach_disconnected) { Then run "rcapparmor reload" to reload the profiles. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c5 --- Comment #5 from Mindaugas Baranauskas --- OK, I added the attach_disconnected flag. Yes, this is not typical system: this LiveUSB, made in SUSE Studio, read-only image with writing overlay in RAM. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c7 --- Comment #7 from Mindaugas Baranauskas --- # mount devtmpfs on /dev type devtmpfs (rw,relatime,size=3867940k,nr_inodes=966985,mode=755) tmpfs on /dev/shm type tmpfs (rw,relatime) tmpfs on /run type tmpfs (rw,relatime,mode=755) devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620,ptmxmode=000) /dev/sr0 on /livecd type iso9660 (ro,relatime) /dev/loop0 on /read-only type squashfs (ro,relatime) /dev/ram1 on /read-write type ext3 (rw,relatime,data=ordered) overlay on / type overlay (rw,relatime,lowerdir=/read-only,upperdir=/read-write/rw,workdir=/read-write/work) sysfs on /sys type sysfs (rw,relatime) proc on /proc type proc (rw,relatime) securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime) tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,mode=755) cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd) pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime) cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset) cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct) cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio) cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory) cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices) cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer) cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls,net_prio) cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event) cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,hugetlb) systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=21,pgrp=1,timeout=300,minproto=5,maxproto=5,direct) mqueue on /dev/mqueue type mqueue (rw,relatime) hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime) fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime) debugfs on /sys/kernel/debug type debugfs (rw,relatime) tracefs on /sys/kernel/debug/tracing type tracefs (rw,relatime) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c9 --- Comment #9 from Mindaugas Baranauskas --- Medium don't save changes across reboots... If you want, I can play again... -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c10 --- Comment #10 from Christian Boltz --- *** Bug 984329 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c12 --- Comment #12 from Mindaugas Baranauskas --- Created attachment 682028 --> http://bugzilla.opensuse.org/attachment.cgi?id=682028&action=edit audit.log files at various time points I did steps again in VirtualBox. New lines after "flags=(attach_disconnected)" added : type=SERVICE_START msg=audit(1466764408.510:787): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="avahi-daemon" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' type=SERVICE_START msg=audit(1466764412.678:788): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="nscd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c14 Fabian Vogt changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fvogt@suse.com --- Comment #14 from Fabian Vogt --- *** Bug 987432 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c16 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jrjohansen117@gmail.com --- Comment #16 from Christian Boltz --- Just a quick update: I discussed this with upstream, and it will be solved with a kernel patch so that AppArmor will ignore overlayfs private loopback mount. This patch is not upstreamed yet, but John promised to do it :-) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 Andre Barros changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andre.cbarros@yahoo.com Version|Leap 42.1 |Leap 42.2 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=984330 http://bugzilla.opensuse.org/show_bug.cgi?id=984330#c19 --- Comment #19 from Christian Boltz --- I'm afraid there's not much progress :-(

From #apparmor (shortened to the relevant lines):

<cboltz> jjohansen: are there any news about ignoring overlayfs private loopback mount? <jjohansen> cboltz: some minor work, but nothing for anyone to test <jjohansen> cboltz: its just a lot uglier than it should be <jjohansen> the easy quick solution didn't pan out -- You are receiving this mail because: You are on the CC list for the bug.